Merge pull request #22 from aws-samples/vpc

added vpc support

Author: jakebark

README.md

@@ -73,6 +73,12 @@ module "pipeline" {
   terraform_version = "1.5.7"
   checkov_version   = "3.2.0"
   tflint_version    = "0.48.0"
+
+  vpc = {
+    vpc_id             = "vpc-011a22334455bb66c",
+    subnets            = ["subnet-011aabbcc2233d4ef"],
+    security_group_ids = ["sg-001abcd2233ee4455"],
+  }
   
   tags = join(",", [
     "Environment[Dev,Prod]",
@@ -109,6 +115,8 @@ module "pipeline" {
 
 `tflint_version` controls the [tflint](https://github.com/terraform-linters/tflint) version. It defaults to 0.48.0.
 
+`vpc` configures the CodeBuild projects to [run in a VPC](https://docs.aws.amazon.com/codebuild/latest/userguide/vpc-support.html).  
+
 `tags` enables tag validation with [tag-nag](https://github.com/jakebark/tag-nag). Input a list of tag keys and/or tag keys and values to enforce. Input must be passed as a string, see [commands](https://github.com/jakebark/tag-nag?tab=readme-ov-file#commands). 
 
 `tagnag_version` controls the [tag-nag](https://github.com/jakebark/tag-nag) version. It defaults to 0.5.8.

codebuild.tf

@@ -11,6 +11,7 @@ module "validation" {
   build_spec            = "${each.key}.yml"
   log_group             = aws_cloudwatch_log_group.this.name
   image                 = each.value
+  vpc                   = var.vpc
 }
 
 module "plan" {
@@ -22,6 +23,7 @@ module "plan" {
   build_spec            = "plan.yml"
   log_group             = aws_cloudwatch_log_group.this.name
   image                 = "hashicorp/terraform:${var.terraform_version}"
+  vpc                   = var.vpc
 }
 
 module "apply" {
@@ -33,6 +35,7 @@ module "apply" {
   build_spec            = "apply.yml"
   log_group             = aws_cloudwatch_log_group.this.name
   image                 = "hashicorp/terraform:${var.terraform_version}"
+  vpc                   = var.vpc
 }
 
 resource "aws_iam_role" "codebuild_validate" {
@@ -49,12 +52,10 @@ data "aws_iam_policy_document" "codebuild_validate_assume" {
   statement {
     effect  = "Allow"
     actions = ["sts:AssumeRole"]
-
     principals {
       type        = "Service"
       identifiers = ["codebuild.amazonaws.com"]
     }
-
     condition {
       test     = "StringLike"
       variable = "aws:SourceArn"
@@ -69,12 +70,10 @@ data "aws_iam_policy_document" "codebuild_execution_assume" {
   statement {
     effect  = "Allow"
     actions = ["sts:AssumeRole"]
-
     principals {
       type        = "Service"
       identifiers = ["codebuild.amazonaws.com"]
     }
-
     condition {
       test     = "StringEquals"
       variable = "aws:SourceArn"
@@ -109,7 +108,6 @@ data "aws_iam_policy_document" "codebuild" {
       "logs:CreateLogStream",
       "logs:PutLogEvents"
     ]
-
     resources = [
       "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:*"
     ]
@@ -122,7 +120,6 @@ data "aws_iam_policy_document" "codebuild" {
       "codebuild:UpdateReport",
       "codebuild:BatchPutTestCases"
     ]
-
     resources = [
       aws_codebuild_report_group.sast.arn
     ]
@@ -134,7 +131,6 @@ data "aws_iam_policy_document" "codebuild" {
       "s3:GetObject",
       "s3:PutObject"
     ]
-
     resources = [
       "${aws_s3_bucket.this.arn}/*",
     ]
@@ -151,6 +147,21 @@ data "aws_iam_policy_document" "codebuild" {
       "*"
     ]
   }
+
+  dynamic "statement" {
+    for_each = var.vpc == null ? [] : [var.vpc]
+    content {
+      effect = "Allow"
+      actions = [
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeVpcs"
+      ]
+      resources = [
+        "*"
+      ]
+    }
+  }
 }
 
 resource "aws_codebuild_report_group" "sast" {

codepipeline.tf

@@ -106,12 +106,10 @@ data "aws_iam_policy_document" "codepipeline-assume-role" {
   statement {
     effect  = "Allow"
     actions = ["sts:AssumeRole"]
-
     principals {
       type        = "Service"
       identifiers = ["codepipeline.amazonaws.com"]
     }
-
     condition {
       test     = "StringLike"
       variable = "aws:SourceArn"
@@ -142,7 +140,6 @@ data "aws_iam_policy_document" "codepipeline" {
       "s3:PutObjectAcl",
       "s3:PutObject"
     ]
-
     resources = [
       "${aws_s3_bucket.this.arn}",
       "${aws_s3_bucket.this.arn}/*"
@@ -155,7 +152,6 @@ data "aws_iam_policy_document" "codepipeline" {
       "codebuild:BatchGetBuilds",
       "codebuild:StartBuild"
     ]
-
     resources = [
       "arn:aws:codebuild:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:project/${var.pipeline_name}-*"
     ]
@@ -171,7 +167,6 @@ data "aws_iam_policy_document" "codepipeline" {
       "codecommit:CancelUploadArchive",
       "codestar-connections:UseConnection"
     ]
-
     resources = [
       var.connection == null ? "arn:aws:codecommit:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${var.repo}" : var.connection
     ]

eventbridge.tf

@@ -47,12 +47,10 @@ data "aws_iam_policy_document" "eventbridge_assume" {
   statement {
     effect  = "Allow"
     actions = ["sts:AssumeRole"]
-
     principals {
       type        = "Service"
       identifiers = ["events.amazonaws.com"]
     }
-
     condition {
       test     = "StringEquals"
       variable = "aws:SourceAccount"
@@ -79,7 +77,6 @@ data "aws_iam_policy_document" "eventbridge" {
     actions = [
       "codepipeline:StartPipelineExecution"
     ]
-
     resources = [
       aws_codepipeline.this.arn
     ]

modules/codebuild/main.tf

@@ -22,7 +22,6 @@ resource "aws_codebuild_project" "this" {
         value = environment_variable.value
       }
     }
-
   }
 
   logs_config {
@@ -39,5 +38,15 @@ resource "aws_codebuild_project" "this" {
     insecure_ssl        = false
     report_build_status = false
   }
+
+  dynamic "vpc_config" {
+    for_each = var.vpc == null ? [] : [var.vpc]
+    content {
+      vpc_id             = vpc_config.value.vpc_id
+      subnets            = vpc_config.value.subnets
+      security_group_ids = vpc_config.value.security_group_ids
+    }
+  }
+
 }
 

modules/codebuild/variables.tf

@@ -29,3 +29,12 @@ variable "log_group" {
 variable "image" {
   type = string
 }
+
+variable "vpc" {
+  type = object({
+    vpc_id             = string
+    subnets            = list(string)
+    security_group_ids = list(string)
+  })
+  default = null
+}

variables.tf

@@ -111,3 +111,12 @@ variable "tflint_version" {
   type    = string
   default = "0.48.0"
 }
+
+variable "vpc" {
+  type = object({
+    vpc_id             = string
+    subnets            = list(string)
+    security_group_ids = list(string)
+  })
+  default = null
+}